Pinkie Pie Earns $60K At Pwn2Own With Three Chromium 0-Day Exploits 148
Tackhead writes "Hot on the hooves of Sergey Glazunov's hack 5-minutes into Pwn2Own, an image of an axe-wielding pink pony was the mark of success for a hacker with the handle of Pinkie Pie. Pinkie Pie subtly tweaked Chromium's sandbox design by chaining together three zero-day vulnerabilities, thereby widening his appeal to $60K in prize money, another shot at a job opportunity at the Googleplex, and instantly making Google's $1M Pwnium contest about 20% cooler. (Let the record show that Slashdot was six years ahead of this particular curve, and that April Fool's Day is less than a month away.)"
You know what this calls for? (Score:5, Funny)
Re:You know what this calls for? (Score:5, Funny)
Re: (Score:1)
Wait, who invited Star Swirl the Bearded?
He's always such a downer!
Re: (Score:3)
Assume the party escort submission position!
Re: (Score:2, Interesting)
Well, since [youtube.com] you [youtube.com] asked [youtube.com] nicely [youtube.com], allow me to deploy the Party Cannon like a boss [youtube.com]. PARTY [youtube.com] HARD [youtube.com]! I'm pony and I know it [youtube.com]!
OK. Virus Alert! [youtube.com] now over, and while we're waiting for the patch, let's watch the Dead Parrot Sketch [youtube.com], chug a mug o' mead and back to Skyrim [youtube.com], Portal [youtube.com], TF2 [youtube.com], or whatever else you're playing tonight.
And I found all that stuff within ten minutes of random youtube surfing. My brain is full of pinkie pie [mylittlefacewhen.com], and I love it.
It's like the god
Re: (Score:1)
Re: (Score:2, Funny)
This is your singing telegram I hope it find you well
I found a browser exploit and it's working pretty swell
Chrome's in version seventeen, but its sandbock's not complete
I bought myself a vic'try cake, it hope it really sweet
There will be massive patching i'm sure in a day or three
And when you've downloaded the fixes, send some thanks to me
No need to write a check, mr google's was enough
But hacking not about the cash, but out stuff
The hole's just in the browser, they'll patch it before too late
but please oh
Re:You know what this calls for? (Score:5, Funny)
Pinkie Pie Earns $60K At Pwn2Own With Three Chromium 0-Day Exploits
Oh, sure, we're laughing now... but this should be a wake-up call.
While at first glance they seem almost indistinguishable from us, there is actually a vital difference between Ponies and ourselves—educational systems.
Pony schools are far more intense than ours, especially in the maths and sciences. If you're familiar with the so-called "math" taught in our primary schools, you will agree that this image is disturbing. [imgur.com] Young fillies (and colts, though their society is strongly gender-biased) are also taught a tremendous work ethic and social responsibility virtually from birth; in fact, they are expected to demonstrate exceptional talent and plan a career even before they reach adolescence. Furthermore, Ponies are even taught to take responsibility for the world around them. Their town, their environment...hell, the Sun, Moon and skies might as well be in their charge. They possess a drive that we fail to instill in our own children.
None of this is particularly surprising when you consider that Equestria is an autocratic state whose leader has a singular fixation on education. While our leaders focus on populism and pork, Equestria sinks more and more resources into teaching even while its infrastructure and government services seem positively primitive.
What does this mean for us? In the short term we'll continue to maintain our dominance in industry, but farther out...simply put, we're fucked. While our children fall farther and father behind, their foals dash ahead. They're already pumping out incredible individuals and technologies that defy belief. I fully expect that the first footprints on Mars...will be hoofprints. But that's not the worst of it. In the next decade, a pony will likely take your job. Soon they'll be running our entire country.
I know what you're thinking right now: "Oh my god...Ponies, rule?". But the answer is yes, and I can't put too fine a point on it: It's only a matter of time before Ponies totally and completely rule everything. That is—unless you do something about it today. Write to your representatives. Tell them unless we all want to start singing Pony anthems, they can no longer claim to be strong on education while cutting budgets and shirking responsibility.
Tell them that starting tomorrow, their actions must match their words.
Tell them they must stop this hippocracy.
Hippocracy (Score:5, Funny)
Tell them they must stop this hippocracy.
This might be the first time I've seen a misspelling of "hypocrisy" used as a legitimate pun (hippo=horse, cracy=government). And it isn't even a copypasta (or at least one indexed by Google). Bravo.
Re: (Score:2)
It's only a matter of time before Ponies totally and completely rule everything.
WebKit (Score:5, Interesting)
It's interesting that the article implies the flaw is in WebKit rather than, say, JavaScript or Flash. So there'll need to be a similar patch made for Safari (which the article also briefly touches on).
Re: (Score:3, Funny)
Frankly, that's impossible.
Safari is perfect, like everything else Apple makes.
Re: (Score:2)
I've heard you lot say that countless times, but I've never actually heard a Mac fanboi say it. Way more annoying.
Re: (Score:2)
Ive heard people 'defend' Apple, as you put it. I haven't heard 'perfect' or 'totally secure', or even 'invented'. Well, I have, but it all came from the Haterade Addicts.
Re: (Score:2)
If you head over to the macrumors (or other mac) forums, you'll find that plenty of apple "fanbois" are some of the most demanding, critical users around.
Far from "everything apple makes is perfect", there has been much gnashing of teeth over recent iOS updates, Lion, Apple dropping support for older macs on Mountain Lion, etc, etc.
Re: (Score:1)
Not just webkit but also Google's Sandbox.
One of the reasons I use Chrome and IE 9 is because of sandboxing. Firefox still does not support it, but there are ways around it. Java had sandboxing too from day 1 and we all know how well that turned out to be the last few years security wise.
Re: (Score:3)
One of the reasons I use Chrome and IE 9 is because of sandboxing. Firefox still does not support it, but there are ways around it. Java had sandboxing too from day 1 and we all know how well that turned out to be the last few years security wise.
Such is the case when you compile data to machine-code at run-time, then flag it as executable and run it.
Re: (Score:3)
Re: (Score:2)
No PHP does not compile to native code, it would be faster if it did. Instead it is compiled to bytecode.
Pretty much no1 except for Facebook compiles PHP to native code, they have 2 projects. One which compiles it as a single binary, which they probably use now and a newer project which tries to the it at runtine. But that project isn't done yet.
Re: (Score:2)
This is why, for general web browsing, I use Firefox in a stripped-down VM. A bit extreme, but my main machine has never been infected by anything, and the VM only got hit once. Reverted to a backup image and I was back in business. I hear Sandboxie is nearly as effective as this setup, too.
Re: (Score:3)
Re:WebKit (Score:5, Insightful)
I "see" a lot of linux boxes on daily basis (yeah, that was right) and NONE of them has AV, some of the do have some kind of "enterprise protection", but unless you are talking about an email server, on linux you usually do not have any kind of AV running, and yet I (on daily basis again) use chrome and firefox a lot for fun and profit, so, an exploit for them is important for me, AV or not involved.
Re: (Score:3)
Do you run Chrome on a PCI DSS certified server? If not, then how the hell is that relevant?
Re: (Score:1)
AV's sweet spot is spotting known exploits by scanning files for signatures. Everything else is mostly just snake oil. You pay them money and they make you feel better with their elixir.
AV software won't work well for Linux viruses because Linux exploits are mostly remote exploits. The AV software can't scan it and match any signatures, and once an exploit gets root access it quickly hides itself. It works better on Windows because the vector is usually attachments.
Re: (Score:2)
If the developer can create a zero-day exploit why would he/she ship a payload which is already recognised by the AV ?
Also a lot of malware just gets a new version every 15 minutes by the push of a button. The AV vendors can't keep up. Detectionrates are going down.
Just a few days ago someone asked me to look at a Windows machine which had malware, I uploaded the binary to virustotal and virscan and they both mentioned things like: 7 out of 34 scanners recognise it. Most of the virusscanners that did recogn
Re: (Score:2)
Re: (Score:2)
Comodo and Avast are both on the list of virustotal.com and virscan.org they both didn't recognise it.
The whole AV-industry is a mess.
I've already seen it happen years ago on my mailservers, you get a new virus-/malware-variant every 15 minutes or so. They aren't recognised yet by the AV-vendor. It takes more time for the AV-vendors to come up with a signature than the bad guys can generate new variants. By the time the AV vendor has a signature a new variant already exists and the bad guys stopped sending
Re: (Score:2)
Having AV installed is missing the point. AV is like an airbag in your car. If your brakes fail and you have an accident, it limits damage to you.
The point of pwn2own is to find vulnerabilities in the browser. i.e., in the above scenario, you could compare it to making sure the brakes work on your car. AV definitions are never 100% up to date - the whole notion of a "0-day" exploit is that it hasn't been published, hence the AV defs will likely not catch it. If the browser was secure in the first pl
Re: (Score:3, Informative)
Well, I don't know which of the linked articles *you* read, but the one I read clearly stated that the first attack vector was a flaw in the Flash plug-in. Chrome's sandbox apparently was then unable to protect the system against the haywire Flash plug-in. So not a flaw in WebKit, to all probability, but three others in Chrome. The article didn't state whether they counted the flaw in the Flash plug-in, but even if they did there are probably at least two flaws in the sandbox.
As it stands, it confirms what
Re:WebKit (Score:4, Informative)
Putting "Flash" under "Privacy" makes sense if you understand how much of the Flash out there really gets used. Flash apps can store a fair bit of data locally on your HD without setting a normal HTTP cookie, [wikipedia.org] which makes tiny, invisible Flash apps handy for tracking purposes.
While the average web surfer doesn't think about Flash in that way, it's not too surprising a company that makes its fortunes on ad revenue and customer profiling understands its real role on the Web.
This is why I run flash-block, and only unblock the very occasional app and/or game I care to interact with, and not the half dozen other ones on the same page that don't seem to do anything interesting to me.
Re: (Score:3)
And just how exactly does that stop FooCompany.com from tracking me on their website even if I have cookies disabled? The answer is: it exactly allows FooCompany.com to track me more thoroughly. In fact, Bank of America uses one of these Flash apps to identify the computer I'm logging in from. It will skip some of the extra authentication steps it normally does.
The main use model I've heard is for these flash apps to store backup copies of cookies you might have blocked or deleted. Alternately, you can
Re: (Score:2)
I'm not saying it's some big security hole. I'm saying it's the reason it ended up under the "Privacy" tab in Chrome, as opposed to somewhere else.
Vector animations and games (Score:2)
websites shouldn't rely on [Flash Player] (offer alternative functionality such as downloads or HTML 5 video)
For a vector animation or a game that was made in Flash or another SWF-making tool, what would such "downloads" be, other than the SWF itself? A vector animation such as "Badger Badger Badger" would become ten times bigger in bytes if automatically converted to WebM or MP4, and a game would become a playthrough video.
Re: (Score:2)
These all allow the execution of arbitrary code on the user's machine, with at least the same access level as the user running the browser.
Which is the point of the sandbox. The rendering process does not have the same level of access as the user running the browser, it has a severely limited subset of access. The original question made sense, because Chrome and Safari both implement sandboxing, but they do it in different ways.
As the Slashdot Front Page Said at One Time... (Score:3, Insightful)
OMG!!! Ponies!!!
Re:As the Slashdot Front Page Said at One Time... (Score:5, Funny)
Ugh, pwnies.
Life imitates pun.
Re: (Score:2)
Better April Fools Idea (Score:1)
Be Creative!
Why don't you have a banner that says "Optimized for IE 6! Enjoy the new support the best browser available. [saveie6.com] . Link a whole bunch of articles including the one at arstechnica that showed IE 6 usage jumped last month.
Go dig up some CSS from Slashdot 2002 era from slashcode. Let us officeworkers use it for a day or need to click "compatibility mode" for IE 8 and 9. You have the code?
Maybe put the blue colors of XP mode in its colors.
Pwn2Own rocks. (Score:4, Insightful)
The best thing about Pwn2Own is that it can be a shot of reality for anyone who gets overly confident in how awesome their favorite OS or browser is. Im a huge fan of Chrome and was hoping it would stand up without any 0-days, but its great that Pwn2Own brought to light the reality that there is no "secure web browsing experience" outside of Lynx (and Im willing to bet that could be 0-day'd too).
Re:Pwn2Own rocks. (Score:5, Interesting)
One downside is many are reporting on ZDNet, that the IE 9 exploit that was shown yesterday has new trojans already working for it.
Since it is a 0 day exploit it is undetectable by any anti virus scanner yet and all you need to do is search under Google Image and you are instantly infected without clicking on anything.
Google at least patched the last one in 24 hours, but I do not trust other browsers or users to patch that quick.
Re: (Score:1)
IE 9 is a good browser. Running everything is so IE 6 pre XP SP 2. Even IE 8 only runs signed activeX controls on intranets only. THe only downside is its sandbox is prone to memory corruption and is exploitable. FF does not even have a sandbox. IE 10 will fix this.
It doesn't I reran the test at zdnet and I did not find any .exe in my %appdata/roaming folders.
My guess is if it is not a flash exploit but a javascript one.
Re: (Score:2)
Re:Pwn2Own rocks. (Score:4, Insightful)
...but its great that Pwn2Own brought to light the reality that there is no "secure web browsing experience"...
It seems to me there must be fundamental problems with the web browser technologies themselves. The web has been extremely popular for a long time now, and it seems no company, no matter how talented, no matter how serious, no matter how security focused, no matter how well staffed, no matter how much money, can make a secure web browser. This is getting ridiculous!
Yes, I'm seriously thinking web technologies themselves are to blame. Overly complex? Over engineered? Fundamentally flawed? Complexity is the enemy of security. It's time for a re-think.
What do other people think? Is it time to trash the old and invent something new, something mere mortals can embrace, and actually create secure implementations?
Re: (Score:1)
Not so sure about the technologies, as the pace of browser development. Security, I think, takes time and thought, which the designers and programmers are not allowed in the interests of getting the next release with new features out.
Re:Pwn2Own rocks. (Score:4, Insightful)
As AC above hinted at, and I believe I quote from some famous computer book or another, "If the structural properties of steel changed 20% every ten years, then Civil Engineering as a discipline would look a lot different."
Point being, you can have breakneck advancement or inherently secure code, but not both at the same time.
Re:Pwn2Own rocks. (Score:4, Interesting)
Is it time to trash the old and invent something new, something mere mortals can embrace, and actually create secure implementations?
The funny part about your post is your idea of a solution is actually the current problem. Technology is changing so fast that No one can have a modern popular functional end user browser while being secure. Security IS HARD, No matter how good a programmer you are you can't possibly imagine every possible type of new exploit technique that will be created tomorrow, next week or next year. It is even harder if every few years you have to rewrite everything, your idea would just bring about a raft of new security issues..
Re: (Score:2)
The funny part about your post is your idea of a solution is actually the current problem.
As has been true of the Simpsons for some time, there is often a relevant XKCD comic. [xkcd.com]
Or maybe, just maybe (Score:5, Insightful)
You can to accept that virtual security is the same as physical security and cannot be perfect in the real world.
See with physical security, we've known this forever. You can't design the unbeatable system. No matter what you design, someone can figure out a way to overcome it, through brute force if necessary. You can't secure something to perfection. So you don't try, you design security to repel any likely threat you you rely on defense in depth so that if one layer fails, the whole system doesn't fail.
However many geeks seem to have talked themselves in to the idea that you can have perfect virtual security. Just use browser X on OS Y and there is no way anything evil can get you, kind of thing. Well I think that is false. You can't have perfect virtual security. Instead, you just have to make it as good as you can against the threat you are likely to face, and then have defense in depth.
Patch your OS and browser, run an on access virus scanner, run a client firewall, have a network firewall, run as a deprivileged user, use things like ASLR and DEP, be safe about your browsing, monitor your system, etc. Don't rely on a single thing to keep you safe, rely on many. Realize that all your layers have defects. Fix them when found, but understand there is no perfection.
This whining that nobody can build something perfect is just stupid. No, they can't, we never have, never will. Deal with it. We don't move out of our houses because they aren't perfectly secure, we aren't going to stop using our computer because they aren't perfectly secure. Get good layered defense and stay on top of it. That is all you can do, all we've ever been able to do.
Re: (Score:2)
This whining that nobody can build something perfect is just stupid.
I don't think anyone reasonable is asking for perfection -- I think that's a red herring designed to denigrate people who suggest that perhaps -- just perhaps -- web browser technology is below reasonable expectations.
For most pieces of software, some reasonable level of defects is expected, otherwise software development costs would be extremely high, and we would be using software with a lot less features. Software having some bugs is the trade-off the vast majority of us are willing make.
However, I think
Re: (Score:2)
You forgot the essential aspect: have backups. At some point, it is likely that if you have valuable data, you may well be hacked, irrespective of whatever precautions you have taken. Humans are fallible, and sooner or later someone is going to put a trojan out there that will fool you, and you will get owned.
Make sure you have backups (so you can recover) and that any confidential data is encrypted (to minimize likelihood of stolen data being used against you).
Re: (Score:2)
You can, but no one will want to use it. Security doesn't trump features for most people's use cases for the web. Including mine. Particularly since you'd have to give up images too.
Re: (Score:2)
Why, exactly? Seems to me that since there is no code in an image that needs to be excecuted, you could easily come up with an image parser for which all chunks of code read are matched to make sure the contents fall within acceptable limits, and if not the parser either gives up or clamps them to reasonable values(to display part of a corrupted image).
Sure, it might be slower than insecure parsers, perhaps by a factor of two or more... But with todays multicore, high-end processors, the reduced speed would
Re: (Score:3)
In theory, you can develop a safe image parser. But in theory, you could develop a safe code sandbox too.
In practice, both are hard problems. Image parsers didn't get exploited because they traded safety for speed, but because the people who wrote them made mistakes and/or didn't consider some edge case, as humans always do.
Re: (Score:2)
I mean there are already compiler warnings that catch a lot of "dodgy" coding habits, unfortunately a lot of people just turn them off and carry on.
I'm not saying this is a
Re: (Score:2)
Very good point, and it should work well -- Any mistakes in the analysis tools will (hopefully) not cause problems with the same mistakes in the actual code, so you'd likely end up making both pieces of code more secure and robust as bugs in one piece of code are brought to light by the other.
Re: (Score:2)
As I said it won't be easy, but an "insecure" code audit tool isn't itself being directly attacked, it merely needs to generate data for function testing and validate results.
So long as we can capture the process of what a code audit is looking for and how, a program can scan through code far faster than a human, and is far less likely to mis-read characters that look similar, overlook punctuation that alters the functionality of code, etc.
Defining *what* to look for in code is (I suspect) the tricky p
Re: (Score:2)
Yes. I agree completely.
Re: (Score:2)
But most compilers don't have enough information to know what you meant to write, so they can't figure out what is the expected behavior.
There are formal provers like Coq [wikipedia.org] that help with that, but they require both knowledge that most programmers don't have and plenty of effort in specifying what's expected of every piece of code - effort that takes away from implementing new stuff.
Now, imagine there are two teams writing a browser: one formally verifies everything and releases an extremely secure browser th
Re: (Score:2)
Image parsers didn't get exploited because they traded safety for speed
Yes, they did, because they were written in C or C++, which allows memory corruption and is how these image parsers were exploited. There are languages that don't allow memory corruption (Java, C#, just about any scripting language, etc.), but they aren't used for performance reasons.
Re: (Score:2)
Sorry, but no. Firstly, there are more reasons besides performance to avoid Java, C# or scripting languages; portability, for example.
Secondly, while the language themselves (as in, syntax + semantics) may not suffer from them, the language implementations (the JVM, the CLR, etc) do.
Re: (Score:2)
Firstly, there are more reasons besides performance to avoid Java, C# or scripting languages; portability, for example.
Java is portable and scripting languages are portable, with fewer porting problems than C/C++. C# with .NET is meant to replace the Win32 API, so if that's your target, portability isn't a concern.
Secondly, while the language themselves (as in, syntax + semantics) may not suffer from them, the language implementations (the JVM, the CLR, etc) do.
But by using the memory-safe languages, much less code is created that suffers these problems. If you look at the Java API, for example, a lot of the API is written in Java itself.
Re: (Score:2)
Java is portable and scripting languages are portable, with fewer porting problems than C/C++.
So, what's the JVM for iOS?
C# with .NET is meant to replace the Win32 API, so if that's your target, portability isn't a concern.
Which in many cases - like, for example, browsers - is.
But by using the memory-safe languages, much less code is created that suffers these problems. If you look at the Java API, for example, a lot of the API is written in Java itself.
And yet it still suffers from buffer overflows - in their image parsers [securityfocus.com], no less!
There's no silver bullet, and managed languages certainly aren't one. Languages with decent typing systems (so, not Java or C#) are better because they can solve a lot at compile time, but they're still not perfect.
Re: (Score:2)
So, what's the JVM for iOS?
That's Apple's decision to restrict their platform. Also, iOS is Objective C when it comes to libraries, not straight C.
Which in many cases - like, for example, browsers - is.
So image parsing bugs written in C are because of a portability problem for IE, which only runs on Windows?
And yet it still suffers from buffer overflows - in their image parsers, no less!
Because they either wrote the underlying implementation in C or used a C library. If anything, it should be a lesson to stop writing code in C unless you really need it.
Re: (Score:2)
That's Apple's decision to restrict their platform.
Irrelevant. C is still more portable.
Also, iOS is Objective C when it comes to libraries, not straight C.
Objective-C is a proper superset of C, meaning any program or library written in C is a valid Obj-C program.
So image parsing bugs written in C are because of a portability problem for IE, which only runs on Windows?
The fact that C# could be a valid choice for IE in no way invalidates my position that portability is a valid reason for choosing C/C++ over C#.
Obviously, if your browser isn't cross-platform, portability isn't an issue. But most browsers are cross-platform.
Because they either wrote the underlying implementation in C or used a C library. If anything, it should be a lesson to stop writing code in C unless you really need it.
And in many cases - like when you want your library to run on mostly everything - you really need it.
Re: (Score:2)
Irrelevant. C is still more portable.
I'll grant you that C is the lingua franca of operating systems, but I do think it's worth mentioning that for iOS it's because Apple is running it like an iron-fisted dictator, and preventing developers from choosing the best technology as they see fit.
The fact that C# could be a valid choice for IE in no way invalidates my position that portability is a valid reason for choosing C/C++ over C#.
It does when browsers like IE fall prey to the same bugs, and you were speaking generally about, "In theory, you can develop a safe image parser. Image parsers didn't get exploited because they traded safety for speed, but because the people who wrote them m
Re:Pwn2Own rocks. (Score:4, Insightful)
Yes, I'm seriously thinking web technologies themselves are to blame. Overly complex? Over engineered? Fundamentally flawed? Complexity is the enemy of security. It's time for a re-think.
Complexity is required to perform arbitrary tasks in a dynamically programmable fashion -- which is essentially what modern HTML/Javascript essentially provides. You can't take something like that are "re-think" it into something less complex than some fundamental measure of the complexity of the application for which it is intended. Either the browser has to be able to perform those functions or users are going to have to accept a web with drastically limited capabilities.
In a broader sense, this is a symptom of the annoying idea that some combination of clever engineering and design decisions can destroy complexity and replace it with something simple. This is superficially true but really what's happening is not that complexity is destroyed, only that it is hidden away -- it's a sort of "conservation of complexity": you can shuffle it around between various layers and (hopefully) hide it from the end user but it's still got to be there somewhere. Consider a cell-phone, it's an insanely complex system involving a all kinds of RF, some arcane protocol, software running on the mobile device, software running the backhaul -- just thinking about it for a second is enough to give you a headache. What the user sees when they dial a number isn't complex not because we've made all those things easy, only because we've relocated it somewhere else.,
The same thing happens in the case of a browser -- I log into gmail and Google dynamically instructs my computer ("over the wire") how to create an entire GUI program that interacts with their server. That's nothing short of amazing and when you say "browsers are overly complex and over-engineering" what you are essentially saying that they should not be able to do that because that complexity came fundamentally and inexorably from the statement of the required functionality. No simple system could every do that ....
Re: (Score:2)
Re: (Score:2)
Hand-waving nonsense.
Re: (Score:2)
There _is_ a fundamental problem with web technologies. It's called "web developers want more features". So browsers add features, and then you get combinatorial explosion of feature interactions and resulting complexity.
You can, of course, try to trash the old and invent something new. It's been tried; see XHTML2. Good luck with that!
Re: (Score:2)
Re: (Score:3)
But, at least now we know there are three fewer 0-day exploits than before. That's something, isn't it?
Re: (Score:2)
Sandboxed? Without hardware VM support? Riiiight. (Score:5, Insightful)
The code isn't in a sandbox if it can escape.
A lot of (desktop) hardware supports virtualization at the hardware level -- This doesn't mean executing a different set of opcodes, it means running an OS inside of an OS. We need hypervisory control at the application level. As long as your application code is running in the same environment as everything else with no hardware supported barriers, then it's not actually in a sandbox.
We compile sections of JavaScript to machine code in data memory, mark the resulting data as code and execute it. It only takes one well placed buffer overflow to get some of your memory corrupted, before data is executed as code. The corruption need not result from JavaScript to affect the JS engine. Additionally, if said JavaScript or HTML or ANY untrusted source of data is being used by native code at the same security level as the application then any bug in that native code (eg: flash, SVG, HTML5 rendering, video/sound codecs, etc) can be an open door out of the "sandbox". This is similar to how such a bug in kernel level code can give you kernel level access... Such is the case for application level code as well.
Data Execution Prevention (DEP [wikipedia.org]) can be used to prevent executing data as code (eg to prevent buffer overflow data from being executed), but since the design of JavaScript makes implementations so slow and we're trying to do so much with it we actually need to execute the data as code. To gain performance we forfeit one of best tools that a "sandbox" can have.
Many that gloat over their browser performance benchmarks wilfully trade security for speed, leaving other more sensible individuals (who may instead throw hardware at a speed issue) without an option... Better browser code can't execute "faster". The hardware runs at the same speed. It can only execute less. That is: more efficiently... More speed requires better hardware, not software.
I would welcome a slower software only VM option (no just in time compiling to machine code), this way hardware DEP could be used to enforce sandboxing more strictly. Until then: My browser runs in its own OS within a hardware supported VM. I start from a fresh known-good VM image before I do anything important on the web. THAT'S a sandbox. Consequently, these restrictions mean I won't do anything important on today's mobile devices...
P.S.
Security researcher red-flags bolded for your convenience.
Re: (Score:2, Insightful)
It's also possible to break out of hardware VMs. Why? Because there's no such thing as a hardware VM. There's hardware-enhanced VMs, but there's still driver and other code which has to interact with the guest OS, thus opening vectors for attack with a much larger attack surface than between two discrete boxes. There have been such exploits published, there are no doubt many unpublished, and there will be more in the future.
Sorry to rain on your parade.
Re:Sandboxed? Without hardware VM support? Riiiigh (Score:4, Informative)
To further rain on the "VMs, even hardware ones, aren't exploitable" parade, the history of hacking the PS3 is always a fun read-
http://wiki.ps2dev.org/ps3:rsx [ps2dev.org]
"
FIFO workaround
The hack consists of asking the Hypervisor to return without waiting for a blit to end. After the Hypervisor returns there is a small length of time during which the FIFO or FIFO registers can be modified before the GPU has finished reading the command. This will occur when a large blit is decomposed into many smaller 1024×1024 blits by the Hypervisor. The last operation pushed to the FIFO by the Hypervisor is a wait for the GPU engine to go idle. By skipping this operation, it is possible to enqueue more commands to the FIFO for the GPU to execute. So the hack consists in either patching the last operation with a NOP, or changing the FIFO write pointer to stop earlier.
"
Re: (Score:2)
It's also possible to break out of hardware VMs. Why? Because there's no such thing as a hardware VM. There's hardware-enhanced VMs, but [...]
I have the image of software breaking out of hardware VMs and becoming a person (perhaps in a robot first, then after Gepetto...).
Sorry to parade on your rain. :)
Re: (Score:2)
Wow, you wrote a very long post to say 'I don't know what I am talking about'.
Every process is sandboxed in a hardware VM. It is using a different instruction set which is restricted from doing anything related to I/O. No process can do anything other than touch its own memory and issue system calls. If it wants to open a socket or access the filesystem, it must issue a system call and then the kernel decides whether to permit this.
Modern browsers (including Chrome) make use of this by running the
More importantly (Score:2)
That guy just got himz a j-o-b.
yay ponies!! (Score:2)
the zero-day buzzword (Score:2)
it's getting annoying. 0-day means exploited the day the vulnerability is exposed. You can have a 0-day exploit. There is no such thing as a 0-day vulnerability.
Re: (Score:2)
So the guy or gal who discovers a vulnerability, writes some malicious code around it, and then throws both into the wild, isn't using a 0 day exploit?
Re: (Score:2)
they are doing exactly that. they have created a 0-day exploit for a vulnerability.
Re: (Score:3)
Re: (Score:1)
A browser exploit is just that - an browser (application) flaw.
Did any OS allow this to become an actual exploit, and if so, which OS?
Re: (Score:3)
You didn't read the article, did you? The Chrome bugs were used to break free of the sandbox, and run arbitrary code on the operating system, which was a fully patched and up-to-date Windows 7.
Re:Who? Did what? For HOW much? and WHY? (Score:5, Insightful)
The question is whether the flaws are in one of these implementations, in the OS APIs that these depend on, or in the higher-level code that's shared among all platforms. The Windows sandboxing implementation is the most complex (about 20KLoC, while the Capsicum implementation is the simplest at around 100LoC) so it presents the largest attack surface.
Re: (Score:3)
Apart from your joke about an imageboard meme related to someone who was cyberbullied into suicide:
Not everybody was brought up speaking English. Other languages' articles (e.g. een, ein, un) don't drop the N before a vowel. I bet grandparent's English is better than your Tlingit.
Re: (Score:2)
Wait, I thought pink was the new black.
Re: (Score:1)
OMG Pwnmemes?
Re:Soon (Score:4, Insightful)
Its not a meme...we're just celebrating the fact that we live in a universe were we can watch a MLP franchise without being unironic as fuck.
Re: (Score:2)
and the unintentional double negative means, good night.
Re: (Score:2)
This.
We live in a universe in which the creators of the cartoon can put the equations that explain time dilation [wikipedia.org] (at constant acceleration) into a 2-second cameo (at 14:22 into Season 2, Episode 20 - "It's About Time") that leads into a character coming to the conclusion that she has to stop time [youtube.com]. Every equation on that blackboard is real. (The thing that looks lik
Re: (Score:2)
Huh, that's a pretty neat catch. That's got to be one of the cooler Easter eggs I've seen in a while. I'm always a bit baffled by how much some people can find in that show...I have a hard enough time just trying to find Derpy...and I usually can't even do that until I see a screenshot pointing it out.
Re: (Score:2)
celebrating the fact that we live in a universe were we can watch a MLP franchise without being unironic as fuck.
I am guessing you meant to write "without being ironic as fuck"
Brohoof?
Re: (Score:2, Insightful)
It's not a meme.
Re: (Score:3)
There's a difference between an internet meme from a fandom. Lolcats, advice animals, or rage comics are memes. Browncoats, Trekkies, Whovians, ect. are clearly not. Guess where ponies fall?
We like a particular show. That isn't much different than any other fan group.
Fandom vs. meme (Score:2)
Browncoats, Trekkies, Whovians, ect. are clearly not.
But are Browncoats, Trekkers, and Whovians a decidedly different demographic [tvtropes.org] from the one that the series' producers originally targeted?
We like a particular show. That isn't much different than any other fan group.
Milhouse is not a meme. "The Simpsons has a fandom" is not a meme. "MLP:FIM has a periphery fandom" is not a meme. But constantly making in-jokes that only "bronies" (the periphery fandom of MLP:FIM) would get is a meme.
Re: (Score:2)
Re: (Score:2)
The name comes from the fact you get the device you "pwn". So you "pwn" the device in order to literally own it.
Re: (Score:2)